What is an API? A Plain-English Guide for Testers
An API is how two pieces of software talk to each other. Here's what that actually means — with runnable examples.
The one-sentence definition
An API (Application Programming Interface) is a contract that lets one piece of software ask another for data or action — in a format both sides agree on in advance.
When you open a weather app on your phone, it doesn't have weather data built in. It asks a weather server, over the internet, using an API. The server replies in a predictable format. The app displays the result. That's it.
Why APIs exist
Before APIs became standard, applications were monoliths: the UI, business logic, and data all lived in one tightly-coupled blob. Changing one part risked breaking everything. Scaling required rebuilding.
APIs decouple systems. Your mobile app doesn't care whether the weather server is written in Go, Python, or COBOL — as long as it sends a request the server understands and gets back a response it can parse. This decoupling is what made the modern internet possible: microservices, mobile apps, AI assistants, IoT devices — they all speak to each other through APIs.
The request / response cycle
Every API interaction has two parts:
- Request — the client (your app, browser, or test tool) sends a message: "Please give me X" or "Please do Y with data Z."
- Response — the server processes the request and sends back a message: "Here is X" or "Sorry, I can't do that because…"
The request contains a method (GET to read, POST to create, etc.), a URL (where to send it), optional headers (metadata like authentication), and an optional body (the data you're sending).
The response contains a status code (200 = success, 404 = not found, 500 = server error), headers, and usually a body with the data or error details.
Your first API call — right now
The sandbox at demo.totalshiftleft.ai is a free, disposable API designed for learning. It has fake users, products, and orders you can create, read, update, and delete. Your data lives in a private session that auto-expires after 10 minutes — no signup, no cleanup.
Click Run to make your first real API call: a GET request that lists all users in your session. Since your session is new, the list will be empty — and that's a valid, successful response.
/api/v1/userscurl -X GET 'https://demo.totalshiftleft.ai/api/v1/users'Look at what came back:
- Status
200— the request succeeded. - A JSON body — structured data the client can parse. JSON (JavaScript Object Notation) is the most common API response format today.
- A
paginationobject — metadata about the dataset. Good APIs always give you more than just the data.
What an API is not
Three common confusions:
-
An API is not a database. A database stores data. An API is the interface in front of the database (or any other system). You can have an API in front of a database, a file system, a machine learning model, or even another API.
-
An API is not a URL. A URL is one piece of an API — the endpoint. A full API is the whole contract: every endpoint, method, request shape, response shape, authentication scheme, and error format taken together.
-
An API is not the same as a web service. "Web service" usually implies an HTTP/REST API. APIs also exist in non-web contexts (operating system APIs, library APIs, hardware APIs). When testers say "API" in 2026, they almost always mean an HTTP-based web API — which is what this learning center covers.
Why testers care
For a tester, APIs are the layer where most bugs hide. UI tests are slow and brittle. Unit tests are fast but don't cover integration. API tests sit in the sweet spot: fast enough to run on every commit, broad enough to catch real integration bugs, and stable enough not to break when a button moves 10 pixels to the left.
This is what "shift left" means: test earlier, test at the API layer, catch problems before they reach production. Everything else in this learning center builds on that foundation.
What's next
You've made your first API call. Next in API 101: the anatomy of a request and response — headers, bodies, and the parts every API call shares. HTTP methods, status codes, authentication and testing come after.
Frequently asked questions
What is the difference between an API and an endpoint?+
An endpoint is one piece of an API: the URL you send a request to. The API is the whole contract, covering every endpoint, method, request shape, response shape, authentication scheme, and error format taken together.
What does an API request contain?+
A request contains a method such as GET or POST, a URL that says where to send it, optional headers carrying metadata like authentication, and an optional body with the data you are sending. The server answers with a status code, headers, and usually a body.
Why do testers focus on the API layer?+
API tests sit between slow, brittle UI tests and fast but narrow unit tests. They are fast enough to run on every commit, broad enough to catch real integration bugs, and stable enough not to break when the user interface changes.
Related lessons
GET, POST, PUT, PATCH, DELETE — the five verbs that carry 99% of API traffic — plus QUERY, the emerging method for safe reads with a body. Here's what each one means, with runnable examples.
2xx means success, 4xx means you messed up, 5xx means they messed up — but the details matter. Here's the list every tester should know by heart.
Every HTTP request has the same parts. Once you know them, every API you'll ever test becomes readable.
Read more on the blog
What API testing is, in simple words: the types of API tests, what to verify on every endpoint, how API testing works step by step, the tools for each job, and the practices that keep a suite fast and trustworthy.
API testing vs UI testing is not an either-or choice — but the order matters enormously. Testing your API layer first (the shift-left principle) catches the majority of application bugs faster, cheaper, and with far less test maintenance than UI-first strategies. This guide explains why API testing should lead your quality strategy.